SNMP - Ports 161, 162, 10161, and 10162/UDP
Last updated
Was this helpful?
Last updated
Was this helpful?
The Simple Network Management Protocol (SNMP) is a widely used protocol for managing and monitoring devices in an IP network. It enables the exchange of management information between network devices such as routers, switches, firewalls, servers, and more. While SNMP is invaluable for network administrators, it can also present a vulnerability if improperly configured or exposed to unauthorized access.
In penetration testing, one of the key areas of focus is identifying weaknesses in SNMP, particularly on commonly used UDP ports like 161, 162, 10161, and 10162. These ports are the default for SNMP operations and can often be leveraged for exploitation. In this article, we'll explore how these ports work, the potential risks they pose, and how to test them effectively during a penetration test.
Port 161 is the primary port used by SNMP agents to receive requests from SNMP managers. This port is responsible for handling requests such as:
Get: Retrieving information from devices.
Set: Modifying the configuration of devices.
Trap: Sending unsolicited notifications from the device to the manager.
Port 162 is used by SNMP managers to receive trap messages. These are notifications sent from SNMP agents about certain events or thresholds that have been exceeded. Traps are important for real-time monitoring but can also expose critical information about the network if intercepted by an attacker.
In SNMPv3, the communication is encrypted, and it uses ports 10161 and 10162. These ports offer a more secure way to handle SNMP requests and responses, as SNMPv3 includes support for authentication and encryption (AES and DES). Despite the added security, misconfigurations can still create vulnerabilities.
While SNMP itself is not inherently insecure, improper configurations or weak implementations can make it a target for attackers. Some of the most common vulnerabilities include:
Default Community Strings SNMP uses community strings, which act as passwords for accessing the device’s management features. The default community strings, such as "public" and "private," are often left unchanged. If an attacker knows or guesses these strings, they can gain access to sensitive data.
Lack of Encryption (SNMPv1 and SNMPv2c) Earlier versions of SNMP (v1 and v2c) do not support encryption, making the data transmitted over the network easily readable. Attackers can sniff network traffic to capture community strings or other sensitive information.
Weak Authentication (SNMPv3) While SNMPv3 supports encryption, its authentication mechanisms can still be weak if poorly configured. Attackers may exploit misconfigured SNMPv3 settings to bypass security measures.
Misconfigured Access Controls Improper access controls can expose SNMP services to unauthorized users. If these controls aren’t adequately implemented, attackers may gain access to SNMP agents and perform actions like changing configurations or exfiltrating sensitive data.
Device Fingerprinting via SNMP SNMP is often used to gather information about network devices. Attackers can exploit publicly exposed SNMP services to fingerprint devices and map out the network topology, which could provide valuable information for later attacks.
Penetration testers commonly target SNMP during a network assessment to identify misconfigurations and vulnerabilities. Testing SNMP typically involves both passive reconnaissance (gathering information) and active exploitation (exploiting identified vulnerabilities).
Here’s how you can test SNMP effectively during a penetration test:
1. Banner Grabbing
Start by identifying devices running SNMP services on ports 161 and 162. Use tools like Nmap or Masscan to scan the network for these ports. This can help you identify devices running SNMP services.
2. SNMP Enumeration
Once you’ve identified devices with SNMP services, you can use enumeration tools like snmpwalk, snmpget, or snmpbulkwalk to gather information from the target devices. If the community string is default or weak, you may be able to retrieve valuable information such as device configurations, running processes, and network interfaces.
3. Brute Force Attacks
If the default community string is not exposed, you can attempt to brute-force community strings with tools like Hydra or SnmpBrute. A successful guess of the community string can allow you to interact with the SNMP agent and gather sensitive data.
4. Exploiting SNMP Traps
If port 162 is open, you can attempt to intercept or send custom SNMP traps. Tools like Wireshark can be useful to monitor for inbound traps, while Metasploit offers the ability to send malicious traps that could trigger an alert or crash the SNMP service.
5. SNMPv3 Testing
When testing SNMPv3, ensure that the devices are using proper authentication and encryption. Weak credentials or misconfigured devices can expose sensitive data or allow unauthorized changes to network configurations. Tools like snmpwalk can also be used with SNMPv3, specifying the username, authentication method, and encryption options.
6. SNMP Write Operations
Misconfigured devices may allow write operations using SNMP. Attackers can change configurations, such as routing tables or device settings, which can have a major impact on network security. It's crucial to test for such vulnerabilities and ensure that write access is restricted or properly protected.
Learn & practice
Become VeryLazyTech ! 🎁
✖ Twitter .
👾 Github .
📜 Medium .
📺 YouTube .
📩 Telegram .
🕵️♂️ My Site .
Visit our for e-books and courses. 📚